donutloader | b28167dfea1bba94b5b3fcf9ffb7c8e4ac6aa64a235b20fa57353854fb8fb4f1

General

Target
27072026_1333_27072026_RFQ-09790098-CS01879-HYU-05979-MQ0978.zip
Size 1.7MB
Sample260727-qtpgbatwds
SHA256 b28167dfea1bba94b5b3fcf9ffb7c8e4ac6aa64a235b20fa57353854fb8fb4f1
MD5 f2186ca4f7eec6d40b9ede977f788723
SHA1 02cb7929179cf6c9e816fd8b85e11ef5b1b9919c
SHA512 c7c7ab21edc503e949f572fa5f424c8af995ae78148a7ea3792a8d3e57ce06bfeac24745f0b8719a4f461287a28205a9effd94d486a4d40555ad1d3e7121e96a
SSDEEP 49152:q5AwlMxXMkmmUtETjNb0XUIrRDt6ysHRjUox:GPl6Mkmm1h0XUSAyEj
TLSH
T1978533BA3DE13C5B5C06991DEE3779BB09ADD57DD7CBF6E0694326F2812D028C4A6080
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.spacaex.com
Port
587
Username
[email protected]
Password
;mU[U{4hFq+cKLx@

Extracted

Family

phantom_stealer

Version

v4.0.0

Credentials

Protocol
smtp
Host
bXDltb2FIulZN+QIR1L26CN1VR09l6TgOUhHWjHLrzpQAAAAaDeZSGfVWJp5kqc89oKYG1oBCZClO9tLzr8XwWnpBD+WNbaoMHoXMNTIKm3LbpOdoFGait9UkGlV1XT5lJau9Cx15sZykqL+o2I7gZbARj2pbUBUgh351VCsF5D+5wEo+rn0RYwc9hIsjgA7z0vsFg==
Username
5U9TxG88N3z8S76geN09sMs9F0fZIou38qK668q1cLlQAAAArfpszPR0cjPIhXLbC4zq/vfFz5h4MRIcXIw94cU839j/J2aOjJE6mf4+lv67JmlIrGHhnH5adF96HkltyUVI8SMUSYLG+Qolb6YgHSFXijSPNLbxXObuRedlNyIwtM09j6Gq4I/qaINwx1DJQD2e0Q==
Password
rFFtstdbN1q8Yll7IWXLTx5WhxT+9DsQ02HXVX+Z56BQAAAAduBO7T5cHspKXVpZfbFnqKoGAAuy0IVMCNKbh1s7dfQnzVyB1DHYG5BkiE43ZxB/NULI9ojG1Tvy4AOJPoEQlvy9aR3VrB2Jo+JU4BicNGL2nE9YEp0PZyUJsl5E+FYeRkOaR0KSZJlR33kW5JkVqw==
Email to
39OJqVKrBvQcoW3qAAy5BEDLvEx0P8ASpsbf6+yL/0JQAAAApC2cC+1BbizuOjAZb3IfgeCcYi2dabO7LpKbBi2mPvz5AhpFpYwIttIws80CruXNSD8kGxjCcMtaA/45WSBDcrSzD3QTMtfTRMATJXD7XMsck9MgzspXrOCl1LC5Wcc03TbW4gSTmGLajm0nIJZoZQ==

Credentials

Protocol
ftp
Host
0
Username
0
Password
0

Mutex

ULWW0ZFGANPFOFD5H3AE

Wallets

8/fhz8MaCGNxnLvHqY4u83J23Fx8BmzXOrqSx3kxfN9QAAAArjYekQVTftNqjM84/0aQ8KXz3LqVB96PPyawrH0zOAN963bmis6lF5QsJGJgrb44A7fuq/a7KMKl4xCN2v/772U23aAhBjT1iTtsYikaq3ElCjuFWkzRJ+78YT+1bzZqaIBFr6pLkv12lGmgynw3+cwpzITKZBw6Uw/wuGYaGOI=
1MMcCM3hcTWHrsrJvB9P1TZvJyxXP6oYEvY/pU7lG7NQAAAAwz5ysTNMwNdkbL0zpnrC5fTGp4XGUDYKS4AE5vHcbGzOUV4EfIYIp+EdAlkXmNfyITGQA8h34GHdAi8qxcH8X1uCJLP/bdV+wCl0K7ycNeEBPzDRlZj/AtLDS2P4wdn+a3pArQBfDlORLc2GlZjqLX38f+pwBLnydko5OqJXOH0=
kDNbWn9QmiU5RtF9A+vBTjuTcbbRRrQzr3/cg+ZYkS9QAAAAdoMpVkJHxFdM9lOo0WrD5tUr6oNJxlby9Eu3IzQ6U8xpmEicXvm5TzskacRfc9e5pruMUqm+l6Bm0na3rIRhzB6J9l5inMlgnFsCS3v//8zu6ZwwDRnyepPcoBcMGlmTZta0WCI+btlburioZCKzKAPerywjIVSV8azdvxuUUhc=
ycVrn8A840OE2sHNdEGwnq7xdOirEiGH7a0PeU8KOgdQAAAAdtL3Mu9o/gnF5rBp6tyXIVyBej+EraD8o66zKgyzBPqPlgwwjSVTH0HntvE4+YBlcJJ2N4Qs63tSbrGl2MKAsuz3PbexWo3TRyKwxa0/XZVlH4HzFHjhRdfgcmrGYMAhURG56ru359zD58vOa5bHQVkNrY/RcylD/sYdL74A/E4=
Ep0YCJzezUFLOlOmGzzC0DaB8bPrprFUcwa/W7Drq85QAAAAWlqkjK88BQ+xI0dzrG+M51w1k8YhYab4NcAfeaMrJ34W4caeORh6LcUHeWD+0nrZQt0ui020CHQtD/GxdO8x6VFHdzloJcT9IB0+aZSdJLUjofmCP9e5loWSlOiXm7UV0iCEa3VURrTeaJ3B3Qp1yJiy68flboDN0/5nbWb796iobhB7REMrwvyCV3aaLyyQFslqSsjgViv1KcRg2EXShLcxEj8lkNyVoapvBD6quns=
CHC4eDei2N5asZNhKRq43SS0ckPoKhfPE2kvKEgtLl9QAAAAOaoVBmyEMNgUU/sPjPhNrnuy3ObwMjJz8RSMxEb5tYPkJ9Gg1eCpQuUoWSbJUpd1jPG47bYLsxbZoOSFgQhWc9ZdxyI3KNTCCvSVqWCCg9sRRl8L8XmIBRovPnHGwuUUtR6HFnZ0edIhstmX830JVCDvHoptSRwXN8QYcXnPljk=
222O8REnG3QAE8h5l8fk/Y6lE6zBBfC5WMUokvk9vKJQAAAAsLcL8UMqRCmGaHK5mzVGIPX6Hu/qo+H5ayow/8mI9KAAjIwdsQ5sVT+C/p8FG6A3+gIg3XOI9Le/YlJ/nDcv8wzmLyUbkiAjPK7HI/vqfgSjaOcT9NwX2XjskcdZ13OyfJWy7zDzTqims/Xbg7/VDclFqnRwWCPMf05LdB9egwQ=

Attributes

clipper
true
credit_cards
true
enable_ssl
true
keylogger
true
passwords
true
screenshot
true
smtp_enabled
true

Targets

- Target
  RFQ-09790098-CS01879-HYU-05979-MQ0978.JS
- Size 4.3MB
- SHA256 311906ba9abe5dd27b295bb2b627e6f03d935e94a1ce4a9eb4ee6907644c1964
- MD5 21c4f4a23c7a2801c1714deeed91f682
- SHA1 df249dd05d6c4f4d5bb20be29aa830fa63b36db1
- SHA512 acad2d00b191b18f186627d0286ebfb64f14d62952961f163cb10242911e4ef30acdc1d4611afd562f4be8388c06f2ba75863223816a653b3f6cfb11359c1fac
- SSDEEP 98304:srlMKQJplI1dzb/a/HugA1DMIdErAS8oZuBX5oRGjqEY9Ywn0mabmY9gs:srlGJplI1d3a/OgA1DMOB2Ua6plL
- TLSH
  T1F526B3851799ED7AB3709FCC2B76DA20634BA20305C5DF02322EC1197AADD87D718BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

collection execution donutloader phantom_stealer loader spyware stealer
- Detects DonutLoader
  loader
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Family: PhantomStealer
  Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
  stealer phantom_stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2